One way quantum bit commitment through classical correlation 



briram Prasath eB 
Maulana Azad National Institute of Technology, Bhopal 



462051, India 



O 
O 

(N 
Oh' 



a,: 



> 



cn 

ON 

o 
o 



X 



Prasanta K. Panigrahfl 

Indian Institute of Science Education and Research (USER) Kolkata, 
Mohanpur, BCKV Campus Main Office, Mohanpur - 741252, India and 
Physical Research Laboratory, Navrangpura, Ahmedabad - 380 009, India 

A one way partial quantum bit commitment protocol is developed, using states with built-in 
classical correlation, completely independent of entanglement. It involves concealing information in 
a set of mutually non-orthogonal states and revealing it through measurements on a set of product 
states that are mutually orthogonal. Given 2^ choices to commit from, the protocol encodes each 
choice in a jV+1 qubit state, from 2^ non- orthogonal states. A previously agreed upon N qubit state 
corresponding to each choice, when coupled with the N + 1 qubit state, yields an element belonging 
to a set of orthogonal product states, which can be deterministically distinguished. The protocol 
is demonstrated by implementing it for a 'coin-toss' game. A procedure to enhance security of the 
protocol is explicated, increasing the number of qubits required. Thus a modification is suggested 
to reduce this required number. 
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Bit commitment is a basic operation in cryptography, 
to which many practically important cryptographic 
tasks, such as quantum coin tossing [![, quantum 
gambling Q, quantum oblivious mutual identification 
Q , quantum oblivious transfer Q and two-party secure 
computations [f|, can be reduced. In a bit commitment 
process between two parties, Alice and Bob, Alice first 
commits her bit with some evidence to Bob. At the 
time of revealing, Alice publishes her commitment and 
Bob verifies it with the evidence. A bit commitment 
is perfect, if it is both binding and concealing. It is 
binding, if Alice cannot change her committed bit, once 
she has made the decision. It is concealing, if Bob cannot 
eavesdrop on the committed bit before the legal revealing 
phase. Classically, bit commitment can be achieved 
with computational security, but not with information 
theoretic security [f|. It was shown by Bennett and 
Brassard Q that, quantum bit commitment can be 
defeated by the use of entangled states. Attempts were 
made to construct secure bit commitment protocols Q, 
which were again proven to be insecure, independently 
by Mayers Q and Lo and Chau It was shown 

that, an entangled attack, akin to that of defeats all 
bit commitment protocols [T3|. Bit commitment using 
at most one cbit of entanglement has been presented 
[lfj. Measurement based semi-quantum key distribution 
protocols have been presented [H, [3, EB| , in which one 
of the parties is classical, but the protocols are robust 
against an eavesdropping attempt. A protocol to hide 
certain quantum states, in non-orthogonal states has 
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been explicated [Tg|. Proof that there exists a protocol, 
whose security increases exponentially with the number 
of systems, which is locally non-classical and lacking 
entanglement, has been recently given [13]. 

Entanglement is a non classical feature, involving non- 
trivial quantum correlation in a multipartite quantum 
system. Apart from entanglement, quantum mechanics 
is endowed with tensor product spaces in Hilbert space. 
In the product space, one can generate non-trivial 
classical correlation through orthogonality, where the 
subsystems are non-orthogonal PJ, EH]. The present 
protocol is developed, using states with built-in classical 
correlation, completely independent of entanglement. 
It involves associating commitment choices to a set of 
mutually non-orthogonal states for concealing the infor- 
mation. It is revealed through measurements on a set of 
product states that are mutually orthogonal. Given 2 N 
choices to commit from, the protocol encodes each choice 
in a N + 1 qubit state, from 2 N non-orthogonal states. 
Previously agreed upon N qubit states corresponding to 
the choices, when coupled with the specific N + 1 qubit 
states, yield elements belonging to a set of orthogonal 
product states, which can be deterministically distin- 
guished, thus revealing the commitment choice. 

There are two parties Alice and Bob, who wish to have 
a quantum bit commitment protocol to communicate 
between themselves. For a given number of commitment 
choices, 2 N , one starts with 2N + 1 qubits. Alice has 
N + 1 qubits and Bob has N qubits. Alice subsequently 
makes a set Bi, with 1 < i < 2 N , where each set contains 
2 N elements. As is evident, choosing one state from a set 
containing 2 N choices increases security. Alice and Bob 
have an initial agreement regarding the commitment 
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choice and the corresponding set Bi. Depending on her 
choice, Alice chooses one member from the appropriate 
set and sends it to Bob. Since, there are equal number 
of sets and commitment choices, each choice can be 
associated with one particular set. This association 
is initially agreed upon; the contents of these sets are 
known to both the parties. Each of these states is a 
superposition of two terms, such that all the elements 
arc orthogonal. Each of these sets, in principle can have 
2 N+1 orthogonal states, however only 2 N states, with 
equal superposition amplitudes, are retained. Terms 
in the superposition have been chosen such that, any 
element of a particular set, has two non-orthogonal 
elements in each of the other sets, ensuring that there 
are no suitable measurement basis, which can reveal the 
information about the chosen state with certainty. In 
principle, this overlap region maybe enlarged with larger 
number of terms in the superposition. In the initial 
agreement, corresponding to each set B il a specific N 
qubit state is associated by Bob. This is required to 
distinguish the overlapping sets, in a bigger Hilbcrt 
space of mutually orthogonal states. At this stage, Bob 
communicates classically his commitment, after which 
Alice reveals her initial commitment. 

In case of disagreement, Bob can generate a N 
qubit state, in reference to their initial agreement, to 
form a 2 2N+1 product space 2^ mutually orthogonal 
states, for distinguishing the initial state with certainty. 
The set of N qubit state generated by Bob has the 
stabilizer codes (a x )® N and (M)® N , where M & (a z ,I) 
and the weight is even, i.e., number of non-identity 
operations is even. The circuit for generation of such 
states is shown in Fig. 1. The qubits in the circuit 
are denoted by \i) 1 ,\j) 27 \k) 3 ,\l) 4 ....,\m) N 6 (|0),|1», 
corresponding to 2 N commitment choices, so that each 
of these can be associated with a commitment choice. 
A schematic representation of the protocol is shown in 
Fig. [21 The initial N + 1 qubit state sent by Alice 
contains two terms as also the N qubit state generated 
by Bob, thus the final product state contains four 
terms, described by the stabilizers I® 3 ® (<Jx)® N and 
J® 3 ® (M)® N , where M e ((?z,I) and the weight is even. 
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FIG. 1: Circuit to generate N qubit state in the revealing 
phase. 

We now explicate the protocol for a 'coin-toss' game 
with two possible commitment choices. It is a two player 



game, played by Alice and Bob. Alice has to toss a coin 
and Bob has to predict the outcome. But as they are 
separated in space, it makes a bit commitment protocol 
necessary for fair play. In our protocol, we use a two 
qubit state at Alice's end and another one qubit state 
at Bob's end to form a three qubit product state. Since 
there are only two possible outcomes in a coin toss, the 
number of choices is 2 and N = 1. In the commitment 
phase, Alice sends a two qubit state to Bob, depending 
upon the output of her coin toss results, based on the 
table I. In case Alice tosses the coin and finds head, she 
can choose to send either l 01 )+l 00 ) or W+l 11 ) both of 
which are elements of B\ . Then they move on to the sec- 
ond phase; through a classical channel Bob guesses the 
outcome of the coin toss. Alice then reveals the result, 
thus indirectly revealing the set B\. In case of mistrust 
they move on to the third phase; Bob generates a one 
qubit state corresponding to the value of i revealed by 
Alice and couples this state with the two qubit state al- 
ready in his possession to ascertain Alice's commitment. 
It can be readily seen that all the four product states, 
shown in table II are mutually orthogonal. Thus Bob 
can make a three qubit measurement in this basis and 
verify Alice's commitment. A schematic representation, 
as per the previous conventions, is shown in Fig. [3l 



TABLE I: The initial agreement table for the commitment 
phase. 



The information to be sent 


Set 


Elements of Bi 


head 


Si 


01)+|00) 

V2 
|10)+|11) 

V2 


tail 


B 2 


|()1) + |10> 

72 
|00)+|11) 

V2 



TABLE II: The initial agreement for the revealing phase. 



N + 1 qubit state 


N qubit state 


product state 


01)+|00) 


|0> + |1> 


|010)+|000)+|011) + |001) 


V2 


V2 


2 


|10) + |11) 


|0) + |1> 


100) + |110) + |101) + |111) 




V2 


2 


|01)+|10) 


|0>-|1> 


010) + |000}-|011)-|001) 


V2 


V2 


2 


|00) + |11> 


|0> — 1 1) 


|000)+|110)-|001)-|111) 


V2 


V2 


2 



The protocol developed here is compliant with several 
desirable requirements. Two sets of states B\ and B 2 
are available corresponding to the commitment choices. 
Each element in B\ has two non-orthogonal states in 
-B2, likewise for each element in B 2 . Since there are only 
two states in each of the sets, every element in one set 
is mutually non-orthogonal to every other element in 
another set. Hence a suitable three qubit measurement 
basis at Bob's end, can determine the parent set of 
the 2 qubit state, with complete fidelity. The protocol 
also ensures that before the revealing phase, Bob has 
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FIG. 2: Schematic representation of the protocol. 
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FIG. 3: Two party 'coin-toss' game. 



no way to form product states and use alternate basis, 
to extract information with complete certainty. If Bob 
intends to form the the three qubit state before the 
legal revealing phase, the plausible final states should 
not be distinguishable. For illustration, Bob couples the 
initial two qubit state with an inappropriate TV qubit 
states, i.e., not in accordance with the initial agreement, 
as shown in table IIIII The product states formed by 
appropriate TV qubit states as shown in table II and 
inappropriate TV qubit states as shown in table III are 
mutually non-orthogonal. From the product states so 
formed, it can be inferred that, the fidelity with which 
Bob can find the parent set Bi, is \. This is equivalent 
to the probability of an arbitrary guess, implying no 
information has been found, before the legal revealing 



phase. Such inappropriate coupling made by Bob, will 
also occur when Alice cheats. These non-orthogonal 
states, can be misused by Alice, to deceive Bob with i 
fidelity This factor can be reduced, if Alice is made to 
split the information into many blocks, and each block 
is communicated through a distinct TV + 1 qubit state, 
as per the protocol. If the number of blocks is K, then 
this fidelity is {\) K ■ The protocol, thus becomes more 
secure with the increase in number of blocks. It can be 
verified that, fidelity does not depend on the value of TV, 
but only on the value of K, implying that a smaller TV 
and a larger K values, ensures a better security. 

When there is a need to send many blocks of infor- 
mation, the above protocol can be modified to reduce 
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TABLE III: States that can be formed apart from the ones in 
revealing phase. 



N + 1 qubit 


N qubit state 


product state 


|01)+|00) 


|0>-|1> 


|010>+|000)-|011>-|001> 


s/2 


V2 


2 


10> + |11) 


[0>— 11> 


|100>+|110)-|101)-|111) 




V2 


2 


|01)+|10) 


|0> + |1> 


|010) + |000>+|011) + |001) 


V2 


V2 


2 


00> + |ll) 


|0)+|1> 


|000) + |110)+|001) + |111) 


V2 


V2 


2 



the number of qubits required. A set S containing 
N + I qubit states in their computational basis as their 
elements, can be considered. In total there are 2 N+1 
such elements are possible, out of which 2 N are initially 
related to each of the commitment choices. Alice can 
select either set S or sets Bi as a parent set, which will 
be used for encoding the commitment. It is clear that all 
the element of the set S are orthogonal, thus information 
appears unconcealed. But with the lack of knowledge of 
the Alice's selection, set S or sets Bi, Bob has no way 
to determine the parent set, since every element of set S 
will have two non-orthogonal elements in each of the sets 
Bi. Alice has to additionally reveal the parent set with 
the commitment. Bob has to prepare the N qubit state 
if sets Bi are chosen for commitment, in case of set S, he 
can measure the N + 1 qubit state in the computational 
basis. Thus the number of required qubits reduces to 
A T + 1 qubits for 2 N choices. The protocol's security 
inversely depends upon the probability of S being the 
parent set, as Bob upon guessing the parent set correctly 



as S, has the complete information. 

In conclusion, a protocol for one way quantum bit 
commitment, is presented for a general situation, involv- 
ing two parties, who initially share a quantum channel 
between them. The protocol is developed using states 
with built-in classical correlation. Since it is independent 
of entanglement, it cannot be subjected to entanglement 
based attack. It involves concealing information in a 
set of mutually non-orthogonal states and revealing it 
through measurements on a set of product states that 
are mutually orthogonal. In order to demonstrate the 
protocol, we have implemented it in a 'coin-toss' game, 
played between two players separated in space. A pro- 
cedure to increase the security is given, ensuring Alice 
does not use the non orthogonal product states formed 
to her advantage. This procedure, eventually increases 
the number of qubits required, but an alternate protocol, 
with a modification is suggested to reduce this number. 
In future, we would like to develop such protocols 
for secure function evaluation and other cryptographic 
tasks which can be reduced to quantum bit commitment. 
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